I'm using the Management Activity API to get events for External Sharing toggle for my O365 tenant collaboration/sharepoint site.
The documentation here ManagementActivityAPI lists down SitePermissionsModified as a potential match for that case.
When I change the settings (say NO EXTERNAL sharing) then I get the following event
{u'Workload': u'SharePoint', u'RecordType': 4, u'ObjectId': u'https://xyz.sharepoint.com/sites/myrc1', u'OrganizationId': u'xxxxxxxx-cce4-48ce-xxxx-xxxxxxxxxxxxx', u'UserId': u'[email protected]', u'CreationTime': u'2016-01-20T07:45:52', u'ItemType': u'Web', u'Site': u'e000000-139e-45df-a5a7-0000000000', u'UserType': 0, u'EventSource': u'SharePoint', u'UserAgent': u'Mozilla/5.0 (blabla; Intel Mac OS X 10.10; rv:43.0) Gecko/20100101 blabla/43.0', u'UserKey': u'i:0h.f|membership|[email protected]', u'Operation': u'SitePermissionsModified', u'Id': u'e000000-a830-469e-ca2f-08d3216db000', u'ClientIP': u'xxx.xx.xxx.xx'}
Now this event doesn't say what change has occurred? It just says SitePermissionsModified, is there a way to know what exactly happened?
The SharePoint team is actively working on updating the sharing related audit events to include more details about the change that occurred. I haven't gotten an ETA from them. Will provide an update as I learn more.